Hacker Deploys Hermes AI Agent for Autonomous Cyberattacks on 460+ Targets

Hermes AI Agent Powers First Confirmed Autonomous Cyberattacks

A Chinese-speaking threat actor has deployed the open-source Hermes AI agent to conduct autonomous cyberattacks against more than 460 systems with minimal human oversight, according to Palo Alto Networks Unit 421

1

. The operator, tracked through aliases knaithe and KnYuan, used DeepSeek as the reasoning engine behind Hermes Agent to launch exploitation attempts after receiving initial instructions via Telegram2

2

. Unit 42 recovered no further operator input during the session, demonstrating what researchers describe as a "functional, end-to-end autonomous offensive capability"2

2

.

The discovery occurred when Hermes accidentally created an unintended web server from its home directory by starting python3 -m http.server 8888 from /home/worker1

1

. This misconfiguration exposed the attacker's environment, including API keys, exploit scripts, target lists, shell history, and autonomous-session logs1

1

. The exposed infrastructure revealed an AI-driven offensive workflow capable of discovering, evaluating, and attacking vulnerable servers without continuous human intervention.

DeepSeek Enables Fully Autonomous Exploitation Workflow

In a recovered May 2026 session, DeepSeek downloaded a public exploit for the Langflow code-injection flaw CVE-2026-33017, enumerated 84 instances through FOFA internet asset search engine, and identified one target running version 1.3.41

1

. When the attack stopped because the system lacked auto_login or a usable public flow identifier, the agent independently surveyed 10 product families and searched GitHub for recent proof-of-concept repositories1

1

.

The agent then selected n8n, the workflow automation platform, and obtained an exploit chain combining CVE-2026-21858 with CVE-2025-686131

1

. FOFA returned 25,209 n8n systems in China during the session, and DeepSeek sampled approximately 100 targets, probed roughly 40, and identified three running vulnerable versions1

1

. Unit 42 confirmed that the agent checked versions, downloaded exploits, abandoned unproductive paths, and chose alternative vulnerabilities based on severity, deployment scale, and apparent exploitability1

1

.

Unit 42 described seven exploit tracks spanning eight CVE identifiers across Langflow, n8n, Marimo, and NetScaler systems1

1

. The researchers reported data exfiltration from three organizations through the NetScaler memory-overread flaw CVE-2026-3055 and command execution on 11 Marimo instances through CVE-2026-399871

1

. The autonomous process executed hundreds of hours of manual targeting analysis in mere minutes while managing its own compute resources2

2

.

YOLO Mode Eliminates Human Approval Requirements

Hermes Agent was configured to operate through Telegram, run commands, and schedule unattended tasks using a feature called YOLO mode2

2

. This mode allows the agent to execute commands, including risky ones, without requesting permission from its operator2

2

. The operator can enable YOLO mode three ways: a --yolo flag at launch, a /yolo command mid-session, or a HERMES_YOLO_MODE=1 environment variable3

3

.

The project's configuration guide explicitly warns to "only use this in trusted, sandboxed environments"3

3

. One safeguard survives YOLO mode: a hardline blocklist that refuses commands which would wipe the machine the agent is running on3

3

. What the operator switched off was the human check, not every safeguard.

Thailand Ministry of Finance Breach Reveals Post-Exploitation Capabilities

In a separate incident, threat intelligence firm Hunt.io and researcher Bob Diachenko discovered exposed web directories containing 585 files totaling approximately 470 MB associated with an alleged breach of Thailand's Ministry of Finance4

4

. The directories contained exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent4

4

.

Five recovered Hermes call logs showed the agent was used to find privilege escalation paths, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems4

4

. The agent worked through the ministry's network checking hosts for ways to gain root access, hunting through file systems, and crawling a folder of staff personnel records dating back to 20123

3

.

The operator was already inside before the agent started, and Hunt.io recovered a hidden web shell planted on a ministry web server3

3

. Scripts were written against named internal Hadoop systems, and stolen mailbox passwords were hardcoded into a mail-testing script3

3

. The operator's scripts targeted a misconfigured Hadoop database service that ships accepting any password by default3

3

.

Organizations Must Patch Vulnerable Systems and Restrict Public Access

Organizations should immediately patch exposed Langflow, n8n, and Marimo systems, along with customer-managed NetScaler ADC or Gateway appliances configured as SAML identity providers1

1

. Langflow fixed CVE-2026-33017 in version 1.9.0, while n8n fixed CVE-2026-21858 in version 1.121.0 and CVE-2025-68613 in versions 1.120.4, 1.121.1, and 1.122.01

1

. Marimo fixed CVE-2026-39987 in version 0.23.01

1

.

Administrators should remove unnecessary public access to workflow and notebook interfaces1

1

. For NetScaler systems, administrators can check appliance configuration for "add authentication samlIdPProfile .*" and install fixed builds listed in Citrix's security bulletin1

1

. Unit 42 assesses the operator to be based in Zhuhai, China, based on recovered GitHub profiles and blog content describing the author as a binary security researcher in that city1

1

. Hunt.io and Diachenko notified ThaiCERT and Thailand's National Cyber Security Agency on July 154

4

.